General

  • Target

    65dee8888e556bb11ab4702907fcdec4605ec16822ea0dd5bccf909e7f999bec

  • Size

    785KB

  • Sample

    220725-ewqavaece7

  • MD5

    81a36e65a4125c7563762571ddb7fe4c

  • SHA1

    2ee913b6c4fd0593274ece5972e5b6f0108c304a

  • SHA256

    65dee8888e556bb11ab4702907fcdec4605ec16822ea0dd5bccf909e7f999bec

  • SHA512

    a5ffcd58d4da62d4b3838a0115f2685f91db6fe1b6e5f985e60e450a7bb6dcc2fae58e69facbc6f45acda572a0a2ac7903513b015a40820b711a370cf03b16bc

Malware Config

Targets

    • Target

      65dee8888e556bb11ab4702907fcdec4605ec16822ea0dd5bccf909e7f999bec

    • Size

      785KB

    • MD5

      81a36e65a4125c7563762571ddb7fe4c

    • SHA1

      2ee913b6c4fd0593274ece5972e5b6f0108c304a

    • SHA256

      65dee8888e556bb11ab4702907fcdec4605ec16822ea0dd5bccf909e7f999bec

    • SHA512

      a5ffcd58d4da62d4b3838a0115f2685f91db6fe1b6e5f985e60e450a7bb6dcc2fae58e69facbc6f45acda572a0a2ac7903513b015a40820b711a370cf03b16bc

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks